CVE-2022-3459

5.3 mediumEPSS 0.3%

Medium (5.3) in lilmonkee woocommerce multiple free gift. EPSS 0.3% chance of exploitation in the next 30 days.

The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add non-gift items to their cart as a gift.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2024-09-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lilmonkee:woocommerce_multiple_free_gift

References

https://plugins.trac.wordpress.org/browser/woocommerce-multiple-free-gift/trunk/lib/WFG_Frontend.class.php#L189
https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb9c321-1a2c-4593-9947-2071a908ee1c?source=cve

Check your stack JSON